Re: [RFC 0/5] [TALPA] Intro to a linux interface for on access scanning

Greg KH
2008-08-05T03:47:09Z

On Tue, Aug 05, 2008 at 11:01:59AM +0800, Cliffe wrote:
> If we had stackable LSMs then the required functionality could simply be
> built into the LSM interface. Then the anti-malware would simply stack
> itself with other LSMs.

Could it really? How would such an interface work?

Remember, the big issue here isn't the kernel "hooks", but the fact that
a lot of people are yet to be convinced that something like this needs
to be within the kernel itself.

Perhaps we should dig up the proposals for the filesystem-notify type
patches, something like that might be all the majority of the virus
people need, as they want to just scan things for Windows viruses, not
Linux ones, and to do so "lazily" might be sufficient.

thanks,

greg k-h